docs: Lumens rev 3.5 — Codex soundness pass (totality/bounds/determinism + fixes)#39
Merged
Merged
Conversation
…ism + fixes)
Independent adversarial review (Codex gpt-5.5, high reasoning; saved verbatim at
docs/protocol/reviews/codex-rev3.4.md) tested SOUNDNESS where the internal passes
tested expressibility, and found a real layer they missed. rev 3.5 addresses all
of it (several default decisions, flagged for veto):
Soundness (new §2.9):
- Totality: ÷0 / mod0 / overflow / NaN / Infinity → defined result or halt with
surface_error; string index/slice clamped; mandatory else.
- Bounds: numerics feeding range/pad/size-ops MUST declare max (validator
rejects unbounded range(score)); per-op output caps.
- Determinism: canonical record-key order (no engine-observable object order);
{random}/{now} as seeded nodes (were missing from the AST catalog).
Effects + replay:
- §6.4: deterministic effectId, declaration-order firing, on:transition XOR
on:{when}, logical-time debounce/coalesce recorded in the trace.
- §13.5 (new): replay/recording model — logical clock, effect-id-tagged result
re-feed, const content-hash in every frame.
- §2.6: normative kernel determinism contract (seed/tie-breaks/float); per-kernel
numbers stay an L0 deliverable, the contract does not.
Contradictions fixed: defs may read state (§2.8); effect args may read {event}
(§6.4); assetRef split from dataRef (§1.1, asset handle vs structured
projection); captureLongPress in EventBinding (§4); StateDelta transition root +
non-overlapping multi-set (§2.5); concept §3 stops calling map/filter/fold
std-lib.
Security: free-colour chrome/consent SPOOFING closed — consent/auth prompts are
host chrome outside the Lumen subtree with unforgeable attribution (§3.1); the
state/DataRef-derived → external-effect TAINT rule made a static AST walk (§6).
Refinements: PortType + port read/emit + expose addressing (§7); hit-test
order/tie-breaks/drag capture (§4.1); loadData lifecycle + cap accounting (§1.1);
dirty-track is optimisation-not-semantic (§5); surface_capability_* wire schema
(§12); capabilityClasses → brokeredCapabilitySupport (§13); {var path} record-
only (§2.2). §11 security table + §14 reclassification updated; walkthrough
examples updated to rev-3.5 grammar; concept v0.11.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Independent adversarial Codex review (saved at
docs/protocol/reviews/codex-rev3.4.md)tested soundness where the internal passes tested expressibility, and found a
real layer they missed. rev 3.5 addresses all of it.
feeding range/pad MUST declare max), determinism (canonical record-key order,
seeded {random}/{now} nodes).
on-XOR, logical-time debounce) + replay/recording with const-hash per frame.
dataRef, captureLongPress, StateDelta root, concept std-lib wording.
surface); taint rule made a static AST walk.
semantics, capability wire schema, brokeredCapabilitySupport.
discussion / the rev-3.5 note in lumens-spec.md.
🤖 Generated with Claude Code